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Background 

This invention relates to an automatic mail rejection 
feature in an e-mail program. 

E-mail can be an inexpensive and effective way of 

10 sending information. Because of this, a recurrent problem 
is "spam", or the sending of unwanted email to a certain 
person. Once an e-mail address gets on a spammer's list, 
the person can be barraged with junk email. Various 
attempts have been made to combat this problem. 

15 For example, some web e-mail programs include the 

ability to block further mail from a specified sender. When 
junk mail is received from a specified address, the control 
is actuated. Further mail from that specified sender is 
then blocked, presumably automatically deleted or sent to 

20 the trash. 

Certain laws also cover spamming, and require that 
each e-mail that is sent unsolicited have a way of 
unsubscribing from the list. Spammers combat both of these 
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measures by continually changing their name and/or changing 
their return address. 

Some e-mail programs allow a user to manually set 
criteria for rejection of incoming email. For example, if 
5 an incoming e-mail is from a domain that has many known 
spammers, many people may simply set their program to 
delete it. However, this has the unintended extra effect 
of also removing desired email, at times. 

In addition, the automatic rejection feature does 
10 nothing to resolve the traffic caused by junk e-mail. 



Summary 

The present application teaches an automatic system 
which automatically recognizes certain aspects of undesired 

15 messages such as junk email and undesired Internet content. 
The system automatically produces recommendations of 
criteria to use in automatically removing undesired 
information. 

In an email embodiment described herein, these 

20 criteria can be automatically enforced or can be presented 
to the user as a table of options. In addition, the system 
can look for keywords in the e-mail, and can automatically 
postulate strategies for rules based on these keywords. 

2 
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Brief Description of the Drawings 
These and other aspects will be described in detail 
with reference to the accompanying drawings , wherein: 
Figure 1 shows an email browser window; 
5 Figure 2 shows a determined spam message, and the 

parsing scheme used on it; 

Figure 3 shows an exemplary computer system; and 
Figure 4 shows and operational flowchart. 



10 Description of the Preferred Embodiment 

A first embodiment describes an e-mail program 
which allows automatic rejection of unwanted messages. The 
embodiment runs on a computer shown in Figure 3, having a 
processor 300 and memory 305. A typical e-mail browser 

15 window is shown in Figure 1. The browser window include a 
number of operating buttons 102 , a list of return 
addresses, and message subject. This browser also includes 
and displays a measure of likelihood of spam quotient or 
"LOSQ". The likelihood of spam quotient is displayed in 

20 the rightmost column as a percentage. For example, a 

message that is known to be spam would have a likelihood of 
spam quotient of 100%. Other messages that are less likely 
to be spam may have a likelihood of spam quotient of 
something less than 100%. 
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The likelihood of spam quotient can be displayed as a 
number as shown in Figure 1, or alternately can be 
displayed by the color of the message being displayed. For 
example, the message can be displayed in green to indicate 
5 low likelihood of spam (e.g. less than 10%) and yellow to 
indicate medium likelihood of spam (e.g. between 10 and 80 
percent, and in red to indicate high likelihood of spam; 
for example likelihood of 80 to 100 percent to be spam, for 
example . 

10 One of the buttons 106 on the toolbar requests removal 

of the high spam likelihood messages from the inbox. This 
enables, in a single click, removing all high likelihood of 
spam messages. Another button 120 is an options button 
which brings up the options menu of Figure 2. 

15 The function buttons in Figure 1 include, as 

conventional, a delete message button 107. An additional a 
"delete as spam" button 111 is also provided. Any message 
that is deleted as being spam is further processed to 
determine characteristics that can be used to process other 

20 messages. Characteristics of the deleted-as-spam message 
are used to update the rules database to indicate 
characteristics of the spamming messages. 

Another button 112 is also provided indicating "delete 
the message; not spam". Therefore, the user is presented 
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with three different options: delete the message without 
indicating whether it is spam or not, delete the message 
while indicating that it is spam, or delete the message 
indicating that it is not spam. 
5 The latter two options are used to update the rules in the 
rules database as described in further detail herein. 
Hence, this option allows adding an incoming e-mail message 
to the spam list, when it is determined to be likely to be 
spam. 

10 Figure 1 also shows a number of different ways of 

displaying different email. The first option, labeled 
"show all messages", on button 104, has the function, as it 
suggests, of showing all messages. The messages may be 
further characterized based on the likelihood that they are 

15 spam. As described herein, the messages are characterized 
by comparing them with rules. Each match with the rules 
may increase the score, and make it more likely that the 
message is spam. More about this operation is described 
herein. 

20 Those messages which are likely not spam are shown in 

a neutral color such as green or black. The messages which 
are questionable are shown in a cautionary color, such as 
yellow highlight. Finally, the messages which are likely 
to be spam are shown in an alert color such as red. 
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A second display option displays only those messages 
which are likely to represent desired messages. Hence, 
only the green and yellow messages are displayed. According 
to one embodiment, the messages are sorted by date and time 
5 received. Within each day, the messages are sorted by 

likelihood of being spam. The spam-likely messages, which 
are determined to be likely to represent spam, may be put 
into a separate folder; here shown as "spam-likely 
messages" . 

10 The messages which are likely to represent undesired 

information can be read by the user. If not read by the 
user, they are kept in the folder for a specified period of 
time e.g. thirty days, before deleting. 

The incoming messages are processed based on rules. 

15 For example, if one does not want to be on a mailing list 
about XXX type items, then messages that include the text 
"free xxx pictures" may be likely to be spam. However, 
other people may find those messages to be highly 
desirable. Similarly, messages about get rich quick 

20 schemes may be trash to one person, treasure to another. 
The present system allows customization of which 
emails to remove as spam, by defining rules. Each time a 
message is deleted as spam, a number of aspects about that 
message are stored. A database is used to store the 
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message. This database may include relative weighting of 
different aspects. Figure 2 shows a determined spam 
message, and the parsing scheme. 

The sender of the message is often a highly 
5 determinative factor. For example, if a specific sender 
sends one spam message, the same sender is very likely to 
be sending another spam message later on. Therefore, a 
first item in the database is the "received from" field 
202. In addition to the specific sender, however, the 

10 domain of the sender often gives information. This domain 
is reviewed at 204. If the domain is a common domain such 
as Yahoo.com or Hotmail.com, then the relevance of the 
sender's domain may not be probative. If, however, the 
domain name is uncommon, such getrichquick.com or the like, 

15 then it is more likely that other message from that domain 
would be spam. Further, many messages from a common domain 
may itself be probative. The domain information is 
weighted accordingly. 

The domain name from an item is added to the rules 

20 database from field 204. Another field 206 stores an 

indication of whether the domain is a common domain or an 
uncommon/ specific domain. This determination is initially 
zero, and is changed depending on the number of hits of 
domains that become present in the database. For example, 
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when two different addresses from the same domain become 
spam, then the value becomes presumptly H (likely to be 
spam) . When two different addresses from the same domain 
are received, one spam, the other not, then the value 
5 presumptively becomes L. 

Each sentence and field in the e-mail, including 
subject; text of the body; links in the email, and any 
others is then stored as a separate field. 

Analogous information may also be categorized from 
10 emails that are deleted as "not spam". This provides a 
database of characteristics that are likely to represent 
spam messages, and other characteristics that are less 
likely to represent spam messages. Matching with the 
databases changes the scoring of the message accordingly. 
15 Once the database becomes sufficiently large, it may 

become time-consuming to compare incoming messages with the 
database. Indexing approaches can be used to increase the 
speed of the comparison. The detailed comparison may also 
be done in the background; the message may be displayed, 
20 and its classification displayed only some time later. 

Figure 4 shows incoming messages received at 400 being 
broken down into analogous parts to those parts that are 
cataloged in the database 410. Each part in the incoming 
e-mail is compared with each part in the database. A 
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simplified index can be prepared, such as the type used for 
internet searching, in order to speed up the searching. 
Each match changes the scoring of the email, to make it 
more likely to be spam, or less likely to be spam at 415. 
5 Each field match has a specified score increase. For 
example, match from the addressee is a very powerful 
indication of spam, and may by itself carry a score of 75. 
100% matching of a sentence may carry a score of 10. A 50% 
word match may carry a score of 3. Match of the hyperlinks 
10 in an e-mail to those in a previously spammed determined e- 
mail may carry a score of 5. 

Similarly, the e-mail and its fields can be compared 
with non-spam indicative email. An e-mail which is not 
spam can carry negative scores, for example. Finding the 
15 e-mail address to be on the non-spam list, for example, can 
carry a score of negative 100, or can immediately abort the 
process with an indication of non-spam. 

If a message has few matches to the database, it may 
be characterized as unknown or cautionary (yellow) . 
20 Similarly, mixed signals (some matches to spam and non-spam 
database), may result in an unknown result. 

The total score for an e-mail is assessed, and this 
total score is used to assess if the e-mail is spam or not. 
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If the e-mail is determined to be spam, then it is 
appropriately processed. 

Many different rules databases can be used. 

Such modifications are intended to be encompassed. 
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What is claimed is : 

1 1. A method, comprising: 

2 receiving an electronic mail message; 

3 displaying information about the electronic mail 

4 message in a way that allows at least one of deleting the 

5 message without indicating whether it is spam or not, 

6 deleting the message while indicating that it is spam, or 

7 deleting the message while indicating that it is not spam. 



1 2. A method as in claim 1 further comprising storing 

2 a database of spam likelihood, and wherein said deleting 

3 while indicating updates information in the database. 

1 3. A method as in claim 1 wherein said deleting 

2 while indicating updates rules in a rules database. 

1 4. A method as in claim 3 wherein said rules include 

2 information about fields from said electronic mail message. 
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1 5. A method as in claim 3 wherein said fields 

2 include at least a sender of the e-mail message, text of 

3 the e-mail message, and a subject of the e-mail message. 

1 6 . A method as in claim 5 wherein said fields also 

2 include a domain of a sender of the e-mail message, 

1 7. A method as in claim 3, wherein said fields 

2 include links within the e-mail message. 

1 8. A method of determining whether an e-mail 

2 represents unwanted information, comprising: 

3 forming rules indicative of contents of the e-mail, 

4 said rules including at least information about a sender of 

5 the e-mail message and information about at least one 

6 other field within the e-mail message other then said 

7 sender or a recipient of the e-mail message. 

1 9. A method as in claim 8 wherein said at least one 

2 other field comprises information in text of the e-mail 

3 message. 
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1 10. A method to as in claim 8, wherein said at least 

2 one other field comprises information within a subject of 

3 the e-mail message. 

1 11. A method as in claim 8 wherein said at least one 

2 other field comprises information about links of said e- 

3 mail message. 

1 12. A method as in claim 8, further comprising 

2 comparing an incoming message to said rules and determining 

3 a likelihood that the incoming message is unwanted based on 

4 said comparing. 

1 13. A method as in claim 12 wherein said comparing 

2 comprises comparing each of a plurality of fields with 

3 rules indicative of said fields and determining a 

4 likelihood that the message is unwanted based on said 

5 comparing. 

1 14. An e-mail program, comprising: 

2 a display portion which is displays a plurality of e- 

3 mails; 

4 a plurality of controls including at least a first 

5 control which selects deleting an e-mail while indicating 
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6 that said e-mail is spam, and a second control which 

7 selects deleting an e-mail while indicating that said e- 

8 mail is not spam. 



1 15. A program as in claim 14, further comprising 

2 displaying a likelihood of spam coefficient which 

3 indicates, on a weighted scale, a likelihood that the 

4 associated message represents spam. 

1 16. A program as in claim 14, further comprising 

2 displaying a control which allows deleting an e-mail 

3 without indicating or not indicating whether said e-mail 

4 represents spam. 

1 17. A method, comprising: 

2 obtaining a message; 

3 monitoring a user's actions with respect to said 

4 message, and automatically forming rules indicating the 

5 desirability of said message; and 

6 using said rules to assess desirability of other 

7 messages. 

1 18. A method as in claim 17, wherein said messages 

2 are electronic mail messages. 
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1 19. A method as in claim 17 wherein said user's 

2 actions include a specific way that the user deletes said 

3 message. 

1 20. A method as in claim 17 wherein said desirability 

2 comprises whether said message is a spam e-mail message. 

1 21. A method, comprising: 

2 determining a plurality of characteristics of an 

3 unwanted message; 

4 forming a list with said plurality of characteristics; 

5 forming a score of an incoming message by comparing 

6 said incoming message with said list and determining 

7 commonalities between said incoming message and said list; 

8 defining said message as likely being unwanted if said 

9 score is within a predetermined range; and 

10 taking an action to restrict said message based on 

11 said defining. 

1 22. A method as in claim 21, further comprising 

2 assessing a common-ness of a domain a sender of a message, 

3 and using said common-ness of said domain. 
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Abstract 

A spam defining system defines rules about emails depending 
on user's reactions to emails. A user can delete an email 
as spam, or not spam, or without committing to whether the 
email is spam or not. If the user indicates whether the 
email is spam or not spam; characteristics of the email are 
used to update a database. Incoming emails are compared 
against the database, to determine a likelihood of whether 
they are spam. 
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